|
Where?
University of Ottawa
(Room Number to be determined)
Ottawa, Ontario, CANADA
When?
Saturday, May 15, 2004
16:30 - 17:30
The 'party' will start immediately after the 4:30pm "All Conference Assembly"
and go until about 5:30. Feel free to start gathering a little earlier to
discuss the merits of PGP, or BSD, or the latest weather reports. :)
Who?
This key signing party is for anyone attending the
BSDCan conference. People not attending
the BSDCan conference are also welcome to participate.
The current table of attendees is here,
and you can view the BSDCan Web of Trust by clicking on the graphic.
Matthew Wilcox has done an even
more interesting analysis too.
Also, Click here to download the keyring.
What's a key-signing party?
A key-signing party is a get-together with PGP users for the purpose of
meeting other PGP users and signing each other's keys. This helps to
extend the "web of trust" to a great degree. Also, it sometimes serves as a
forum to discuss strong cryptography and related issues.
What do I need for this party?
Required Items
- Physical attendance
- Positive picture ID. A passport is recommended, but individuals may
accept other forms of ID such as driver's licenses, health cards, etc.
If in doubt, bring as much ID as possible.
- Your Key ID, Key type, HEX fingerprint, and Key size
- A pen/pencil or whatever you'd like to write with....
- NO computer
Required Process
- Generate a key/Remember your pass phrase
- All attendees send their public keys to a public keyserver. I personally
use subkeys.pgp.net, but any major synchronized server should be
fine.
- All attendees send their key ID, key type, fingerprint, and key size to
the host, keys@bsdcan.org,
who will compile everyone's key information. Please submit your key by
May 14th.
The best way to do this is to
send the output of "gpg --fingerprint my_email@address.ca". It will
look something like this:
pub 1024D/D77B43FB 2002-06-05 Victor Gedris
Key fingerprint = 04A9 75C4 36A3 9925 9606 3F5A 4945 A537 D77B 43FB
sub 2048g/CFF14C4D 2002-06-05
- The host prints a list with everyone's key ID, key type, fingerprint,
and key size from the compiled keyrings and distributes copies of the
printout at the meeting.
- Attend the party. Bring along a paper copy of your key ID, key type,
fingerprint, and key size that you obtained from your own keyring. You
must also bring along a suitable photo ID. Instruct the attendees at the
beginning that they are to make two marks on the listing, one for correct
key information (key ID, key type, fingerprint, and key size) and one if
the ID check is ok.
- At the meeting each key owner reads his key ID, key type, fingerprint,
key size, and user ID from his own printout, not from the distributed
listing. This is because there could be an error, intended or not, on the
listing. This is also the time to tell which ID's to sign or not. If the key
information matches your printout then place a check-mark by the key.
- After everyone has read his key ID information, have all attendees form a line.
- The first person walks down the line having every person check his ID.
- The second person follows immediately behind the first person and so on.
- If you are satisfied that the person is who they say they are, and
that the key on the printout is theirs, you place another check-mark
next to their key on your printout.
- Once the first person cycles back around to the front of the line he
has checked all the other IDs and his ID has been checked by all others.
- After everybody has identified himself or herself the formal part of
the meeting is over. You are free to leave or to stay and discuss
matters of PGP and privacy (or anything else) with fellow PGP users. If
everyone is punctual the formal part of the evening should take less than
an hour.
- After confirming that the key information on the key server matches the
printout that you have checked, sign the appropriate keys. Keys can only
be signed if they have two check-marks.
- Send the signed keys back to the keyservers.
- Use those keys as often as possible.
Why shouldn't I bring a computer?
There are a variety of reasons, why you don't want to do this. The short
answer is it would be insecure, unsafe, and of no benefit. For those not
convinced, here are some reasons why it is insecure, unsafe, and of no
benefit.
- Someone might have modified the computers programs, operating system, or hardware to steal or modify keys.
- If people are swapping disks with their keys on them the computer owner has to worry about viruses.
- If people are carrying their secret keys with them and intend to do
the signing at the actual meeting by typing their passphrase into a
computer, then they are open to key-logging attacks, shoulder-surfing, etc.
- It is much better to just exchange key details and verify ID and then do the signing when you get home to your own trusted computer.
- Someone might spill beer on it.
- Someone might drop it or knock it off the table.
- More reasons, I don't feel like articulating
Other questions about signing keys?
You may want to read the Keysigning Party
Howto which includes an explanation of the concepts behind keysigning,
instructions for hosting a keysigning party, instructions for participating in
a keysinging party, and step by step instructions for signing other's keys.
Other useful PGP links
A few more links for PGP newbies, or those who wish to re acquaint
themselves.
What if I still have a question?
If you'd like some help answering it, you can contact the event
coordinators, via email at keys@bsdcan.org.
|
|
